chore: commit pending admin-panel, api auth and parity doc changes

Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>

apps/api/src/modules/auth/super-admin.ts

@@ -0,0 +1,48 @@
+/**
+ * The one account allowed to see the super-admin-only features (retail
+ * customers and orders, bankers, walk-in shopkeepers, branches and workshops,
+ * retail promotions, wallet management, trays). Matched on mobile, not on
+ * AdminRole.SUPER_ADMIN: that role can be assigned to any admin from the
+ * users form, this account cannot.
+ */
+export const SUPER_ADMIN_MOBILE = '09128081392';
+
+/**
+ * Rids of those features. The admin panel no longer offers them on the
+ * permission screen (except to the super admin), so the super admin is granted
+ * them here whatever its user type holds.
+ */
+export const SUPER_ADMIN_RIDS = [
+  'persons.create.single',
+  'persons.list.client.single',
+  'persons.list.client.single.view',
+  'persons.list.client.single.edit',
+  'branch',
+  'branch.create',
+  'branch.list',
+  'workshop',
+  'workshop.create',
+  'workshop.list',
+  'order.create',
+  'order.list',
+  'order.list.view',
+  'order.list.sts',
+  'order.list.sts.view',
+  'order.list.sts.remove',
+  'order.list.sts.submit',
+  'order.list.view.edit',
+  'order.list.pdf',
+  'offers.create.tak',
+  'offers.list.tak.edit',
+  'offers.list.tak.remove',
+  'config.wallet',
+] as const;
+
+export function isSuperAdmin(mobile: string | null | undefined): boolean {
+  return mobile?.trim() === SUPER_ADMIN_MOBILE;
+}
+
+/** The raw rids an admin holds, plus SUPER_ADMIN_RIDS for the super admin. */
+export function withSuperAdminRids(mobile: string | null | undefined, rids: string[]): string[] {
+  return isSuperAdmin(mobile) ? [...new Set([...rids, ...SUPER_ADMIN_RIDS])] : rids;
+}